4 ms·
It's useful for enterprise customers. It's more advanced than XProtect.
by mey 8y ago
It's useful for enterprise customers. It's more advanced than XProtect.
- jasonvorhe 8y agoHow? XProtect prevents execution of known binaries based on checksums without impacting system performance. How could anything be more effective?
- mey 8y agoMy understanding is XProtect works off signatures and only for data coming in from certain pathways (registered quarantine agents, chrome/safari etc). This doesn't protect against using a vulnerability in an app (chrome/safari) to trigger another process to download a malicious payload. Being signature based instead of behavior based limits it's ability to detect evolving attacks. The following seems to be a good overview of a specific attack bypassing xprotect. https://www.sentinelone.com/blog/how-malware-bypass-macos-gatekeeper/ https://www.sentinelone.com/blog/how-malware-bypass-macos-ga...